[5189] in Kerberos
V5: Can principal names have '@' in them?
daemon@ATHENA.MIT.EDU (Clifford Neuman)
Wed May 17 16:54:29 1995
Date: Wed, 17 May 1995 13:35:35 -0700
From: Clifford Neuman <bcn@ISI.EDU>
To: jik@cam.ov.com
Cc: kerberos@MIT.EDU
In-Reply-To: Jonathan I. Kamens's message of 17 May 1995 20:06:33 GMT <3pdl09$8th@pad-thai.cam.ov.com>
Date: 17 May 1995 20:06:33 GMT
From: jik@cam.ov.com (Jonathan I. Kamens)
With the V5beta2 release, running the command "kinit
foobar@baz@GZA.COM" would yield the message "Password for
foo@GZA.COM:", and obvious indicator of a bug of some sort in the
principal parsing routine when it encounters two '@'s in a principal.
V5beta4pl3, on the other hand, prints "kinit: Malformed representation of
principal when parsing name foobar@baz@GZA.COM". Now, that's *better*, but
I'm still not convinced it's correct, because I can't find anything in RFC
1510 that explicitly says that '@' is an illegal character in a
principal name component.
If it isn't, then "foobar@baz@GZA.COM" should parse into the principal
"foobar@baz" in the realm "GZA.COM".
You are correct. This should be parsed as the user foobar@baz in the
realm GZA.COM.
Does the current working draft of what will replace RFC 1510 say anything
about this? Does anybody have any thoughts about whether '@' should be
an illegal character in principal name components?
I'll make sure that this makes it in. @ should not be illegal in
principal name components. It probably should be illegal in DNS style
realm name, though not illegal for other kinds of realm names. How to
parse in an ambigious situation needs to be thought through.
~ Cliff
